Archibold
27677215bd
Authlib's parse_id_token only reads a 3-segment JWS, so sign-in 500s against providers that encrypt the id_token (Authentik with an Encryption Key issues a 5-segment RSA-OAEP-256/A256CBC-HS512 JWE) or that sign it with the client secret (Authentik with no Signing Key issues HS256, which the RS256-only JWKS rejects). OIDCClient subclasses the starlette OAuth2 client and, when the standard parse fails on a format problem, falls back to an HS256 decode with the client secret, then to the issuer's userinfo_endpoint. Claim-level failures (bad nonce, expiry, audience, issuer) are raised as OAuthError so /auth/callback redirects to /auth/login?error=... instead of blowing up. /auth/authorize likewise catches provider/network errors and redirects to the login page.
18 lines
206 B
Plaintext
18 lines
206 B
Plaintext
# Python-generated files
|
|
__pycache__/
|
|
*.py[oc]
|
|
build/
|
|
dist/
|
|
wheels/
|
|
*.egg-info
|
|
|
|
# Virtual environments
|
|
.venv
|
|
|
|
# Runtime state (services store is created on first run)
|
|
data/
|
|
|
|
# Secrets
|
|
.secrets
|
|
.oauth_creds
|